CompTIA Security+ Exam Prep

115 flashcards by MentisLibrary

The Security+ objectives as study items: control categories and types, cryptography and PKI, threat actors and attack techniques, security architecture, operations and monitoring, incident response, and risk and vendor governance.

What are the five Security+ domains?

General security concepts; threats, vulnerabilities and mitigations; security architecture; security operations; and security program management and oversight.

The CIA triad

Confidentiality keeps data from unauthorized readers, integrity keeps it from unauthorized change, and availability keeps it reachable when it is needed.

What is non-repudiation?

Proof that a specific party performed an action, so they cannot credibly deny it. A digital signature made with a private key only that party holds provides it.

What does AAA stand for and what does each part do?

Authentication proves who you are, authorization decides what you may do, and accounting records what you did.

The four security control categories

Technical controls are implemented in technology, managerial controls are policies and reviews, operational controls are carried out by people, and physical controls restrict physical access.

The six security control types

Preventive stops an event, deterrent discourages it, detective identifies it, corrective fixes it afterward, compensating substitutes for a missing control, and directive tells people what to do.

What does zero trust mean in the Security+ model?

No implicit trust from network location. The control plane holds the policy engine and policy administrator that decide access; the data plane holds the policy enforcement point that carries the decision out.

Physical security controls to recognize

Bollards, fencing, lighting, video surveillance, access control vestibules, guards and visitor logs, plus sensors using infrared, pressure, microwave or ultrasonic detection.

Honeypots, honeynets, honeyfiles and honeytokens

A honeypot is a decoy system, a honeynet is a whole decoy network, a honeyfile is bait data, and a honeytoken is a fake credential or record that alerts when used.

What is a gap analysis?

A comparison of the current security posture against a target framework or policy, producing the list of differences that need remediation.

What belongs in a change management process?

An approval process with named ownership and stakeholders, an impact analysis, test results, a backout plan, a scheduled maintenance window and an updated standard operating procedure.

Symmetric versus asymmetric encryption

Symmetric uses one shared key for both encryption and decryption and is fast. Asymmetric uses a mathematically linked public and private key pair and is slow but solves key distribution.

AES key sizes and block size

AES supports 128, 192 and 256-bit keys and always uses a 128-bit block. It is the standard symmetric cipher for data at rest and in transit.

Which key does what in a public key pair?

Encrypt to someone with their public key so only their private key can read it. Sign with your private key so anyone with your public key can verify it.

How does a digital signature work?

The sender hashes the message and encrypts the hash with their private key. The recipient decrypts it with the sender's public key and compares it against their own hash of the message.

What is hashing used for?

Producing a fixed-length one-way digest that verifies integrity. The same input always gives the same digest and the digest cannot be reversed into the input.

Why salt a password hash?

A salt is a unique random value added to each password before hashing, so identical passwords produce different digests and a precomputed rainbow table becomes useless.

What is key stretching?

Repeatedly applying a hash or a deliberately slow function so testing each password guess costs meaningful time. PBKDF2, bcrypt, scrypt and Argon2 do this.

What problem does Diffie-Hellman solve?

It lets two parties derive a shared secret over an untrusted channel without ever transmitting the secret itself.

What is perfect forward secrecy?

Each session uses an ephemeral key that is discarded afterward, so compromising the server's long-term private key later does not decrypt previously captured sessions.

Public key infrastructure components

A certificate authority issues and signs certificates, a registration authority verifies requesters, a certificate revocation list and OCSP publish revoked certificates, and a chain of trust links a certificate up to a trusted root.

Certificate types worth knowing

A wildcard certificate covers all hosts at one level of a domain. A subject alternative name certificate covers a specific list of names. A self-signed certificate has no external authority behind it, and a CSR is the signed request that asks a CA for a certificate.

TPM versus HSM versus secure enclave

A TPM is a chip on one device's motherboard that stores keys for that device. An HSM is a dedicated hardened appliance that generates and protects keys for many systems. A secure enclave is an isolated processor region that holds keys away from the main OS.

Encryption levels for stored data

Full disk encrypts the whole drive, volume or partition encryption covers one logical volume, file-level covers individual files, and database encryption can protect a whole database, one column or one record.

Obfuscation techniques: steganography, tokenization and masking

Steganography hides data inside other media such as an image. Tokenization replaces a value with an unrelated token held in a secure lookup. Masking shows only part of a value.

Threat actor types

Nation-state, organized crime, hacktivist, insider threat, unskilled attacker and shadow IT.

What makes an insider threat different?

The actor already holds legitimate access, so there is no perimeter to breach and the activity looks like normal work.

What is shadow IT and why does it matter?

Technology adopted by staff without approval or oversight, such as an unsanctioned cloud storage account or a personal device on the network.

Common threat vectors

Message-based delivery by email, text or instant message; image and file-based payloads; voice calls; removable devices; vulnerable or unsupported software; unsecure networks; open service ports; default credentials; and the supply chain.

Phishing, vishing, smishing and pretexting

Phishing arrives by email, vishing by voice call, smishing by text message, and pretexting invents a scenario that justifies the request.